<!doctype html>
<html lang="en">

  <head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
    <title>使用开源工具进行 Linux 内存取证 - 慧林淘友之达人助手</title>
    <meta name="HandheldFriendly" content="True">
    <meta name="MobileOptimized" content="320">
    <meta name="referrer" content="no-referrer">
    <meta name="description" content="慧林淘友之达人助手:交流与建议、BUG反馈。">
    <meta property="og:site_name" content="慧林淘友之达人助手" />
    <meta property="og:locale" content="nn_NO" />
    <meta property="og:type" content="article" />
    <meta property="og:url" content="https://www.lyhuilin.com/posts/linux-memory-forensics/" />
    <meta property="og:title" content="使用开源工具进行 Linux 内存取证" />
    <meta property="og:image" content="https://www.lyhuilin.com/apple-touch-icon.png" />
    <meta property="og:description" content="慧林淘友之达人助手:交流与建议、BUG反馈。" />

    

    <meta property="twitter:title" content="使用开源工具进行 Linux 内存取证" />
    <meta property="twitter:image" content="https://www.lyhuilin.com/apple-touch-icon.png" />
    <meta property="twitter:card" content="summary" />
    <meta property="twitter:description" content="慧林淘友之达人助手:交流与建议、BUG反馈。" />

    

    <link rel="canonical" href="https://www.lyhuilin.com/posts/linux-memory-forensics/">

    <link href="//cdn.jsdelivr.net/npm/bootstrap@5.0.1/dist/css/bootstrap.min.css"
          rel="stylesheet"
          integrity="sha384-+0n0xVW2eSR5OomGNYDnhzAbDsOXxcvSN1TPprVMTNDbiYZCxYbOOl7+AMvyTG2x"
          crossorigin="anonymous" />

    <link rel="stylesheet" href="https://www.lyhuilin.com/css/main.css" />

    

    

    <link rel="shortcut icon"
          href="https://www.lyhuilin.com/favicon.ico">

    <link href='' rel="alternate" type="application/rss+xml" title="慧林淘友之达人助手" />
    <link href="//fonts.googleapis.com/css?family=Fira+Code|Merriweather+Sans:400,700|Merriweather:400,700&display=swap"
    rel="stylesheet">

<style>
    :root {
        --font-code: "Fira Code", monospace;
        --font-content: "Merriweather", serif;
        --font-title: "Merriweather Sans", sans-serif;
    }
</style>
<script>
    var _hmt = _hmt || [];
    (function () {
        var hm = document.createElement("script");
        hm.src = "https://hm.baidu.com/hm.js?d4f2e101b391ba33a192c215809ef30f";
        var s = document.getElementsByTagName("script")[0];
        s.parentNode.insertBefore(hm, s);
    })();
</script>
  </head>

  <body>
    
  

<div class="my-4 my-md-5 header">
  <div class="container">
    <div class="row">
      <div class="col-auto offset-lg-1 d-none d-md-block">
        
          <a href="https://www.lyhuilin.com/">
            <img class="logo" src="https://www.lyhuilin.com/apple-touch-icon.png" alt="logo">
          </a>
        
      </div>
      <div class="col-auto align-self-center mr-auto">
        <a class="text-decoration-none" href="https://www.lyhuilin.com/">
          <h1 class="font-weight-bold name">
            慧林淘友之达人助手
          </h1>
        </a>

        <ul class="nav nav-primary">
          
            <li class="nav-item">
              <a class="text-uppercase nav-link text-home" href="/">
                
                Home
              </a>
            </li>
          
            <li class="nav-item">
              <a class="text-uppercase nav-link text-blog" href="https://3ae.cn">
                
                Blog
              </a>
            </li>
          
            <li class="nav-item">
              <a class="text-uppercase nav-link text-gitee" href="https://gitee.com/lyhuilin">
                
                Gitee
              </a>
            </li>
          
            <li class="nav-item">
              <a class="text-uppercase nav-link text-donations" href="/donations">
                
                Donations
              </a>
            </li>
          
            <li class="nav-item">
              <a class="text-uppercase nav-link text-Download" href="/download">
                
                Download
              </a>
            </li>
          
            <li class="nav-item">
              <a class="text-uppercase nav-link text-support" href="https://support.qq.com/products/65159">
                
                Support
              </a>
            </li>
          

          
        </ul>

        <ul class="nav nav-secondary">
          
        </ul>
      </div>
    </div>
  </div>
</div>


  <div class="content">
    <div class="container">
      <div class="row justify-content-center">
        <div class="col-md-12 col-lg-10">
          <h1 class="mx-0 mx-md-4">
            使用开源工具进行 Linux 内存取证
          </h1>
          <div class="markdown">
            
  <blockquote>
<p>利用 Volatility 找出应用程序、网络连接、内核模块、文件等方面的情况。</p>
</blockquote>
<p>计算机的操作系统和应用使用主内存（RAM）来执行不同的任务。这种易失性内存包含大量关于运行应用、网络连接、内核模块、打开的文件以及几乎所有其他的内容信息，但这些信息每次计算机重启的时候都会被清除。</p>
<p>内存取证是一种从内存中找到和抽取这些有价值的信息的方式。Volatility 是一种使用插件来处理这类信息的开源工具。但是，存在一个问题：在你处理这些信息前，必须将物理内存转储到一个文件中，而 Volatility 没有这种能力。</p>
<p>因此，这篇文章分为两部分：</p>
<ul>
<li>第一部分是处理获取物理内存并将其转储到一个文件中。</li>
<li>第二部分使用 Volatility 从这个内存转储中读取并处理这些信息。</li>
</ul>
<p>我在本教程中使用了以下测试系统，不过它可以在任何 Linux 发行版上工作：</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>$ cat /etc/redhat-release
</span></span><span style="display:flex;"><span>Red Hat Enterprise Linux release 8.3 <span style="color:#f92672">(</span>Ootpa<span style="color:#f92672">)</span>
</span></span><span style="display:flex;"><span>$
</span></span><span style="display:flex;"><span>$ uname -r
</span></span><span style="display:flex;"><span>4.18.0-240.el8.x86_64
</span></span><span style="display:flex;"><span>$
</span></span></code></pre></div><pre><code>注意事项： 部分 1 涉及到编译和加载一个内核模块。不要担心：它并不像听起来那么困难。

一些指南：

    按照以下的步骤。
    不要在生产系统或你的主要计算机上尝试任何这些步骤。
    始终使用测试的虚拟机（VM）来尝试，直到你熟悉使用这些工具并理解它们的工作原理为止。
</code></pre>
<h2 id="安装需要的包">安装需要的包</h2>
<p>在开始之前安装必要的工具。如果你经常使用基于 Debian 的发行版，可以使用 apt-get 命令。这些包大多数提供了需要的内核信息和工具来编译代码：</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>$ yum install kernel-headers kernel-devel gcc elfutils-libelf-devel make git libdwarf-tools python2-devel.x86_64-y
</span></span></code></pre></div><h2 id="部分-1使用-lime-获取内存并将其转储到一个文件中">部分 1：使用 LiME 获取内存并将其转储到一个文件中</h2>
<p>在开始分析内存之前，你需要一个内存转储供你使用。在实际的取证活动中，这可能来自一个被破坏或者被入侵的系统。这些信息通常会被收集和存储来分析入侵是如何发生的及其影响。由于你可能没有可用的内存转储，你可以获取你的测试 VM 的内存转储，并使用它来执行内存取证。</p>
<p>Linux 内存提取器（LiME）是一个在 Linux 系统上获取内存很常用的工具。使用以下命令获得 LiME：</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>$ git clone https://github.com/504ensicsLabs/LiME.git
</span></span><span style="display:flex;"><span>$
</span></span><span style="display:flex;"><span>$ cd LiME/src/
</span></span><span style="display:flex;"><span>$
</span></span><span style="display:flex;"><span>$ ls
</span></span><span style="display:flex;"><span>deflate.c  disk.c  hash.c  lime.h  main.c  Makefile  Makefile.sample  tcp.c
</span></span><span style="display:flex;"><span>$
</span></span></code></pre></div><h3 id="构建-lime-内核模块">构建 LiME 内核模块</h3>
<p>在 src 文件夹下运行 make 命令。这会创建一个以 .ko 为扩展名的内核模块。理想情况下，在 make 结束时，lime.ko 文件会使用格式 lime-<!-- raw HTML omitted -->.ko 被重命名。</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>$ make
</span></span><span style="display:flex;"><span>make -C /lib/modules/4.18.0-240.el8.x86_64/build M<span style="color:#f92672">=</span><span style="color:#e6db74">&#34;/root/LiME/src&#34;</span> modules
</span></span><span style="display:flex;"><span>make<span style="color:#f92672">[</span>1<span style="color:#f92672">]</span>: Entering directory <span style="color:#e6db74">&#39;/usr/src/kernels/4.18.0-240.el8.x86_64&#39;</span>
</span></span><span style="display:flex;"><span>
</span></span><span style="display:flex;"><span>&lt;&lt; 删节 &gt;&gt;
</span></span><span style="display:flex;"><span>
</span></span><span style="display:flex;"><span>make<span style="color:#f92672">[</span>1<span style="color:#f92672">]</span>: Leaving directory <span style="color:#e6db74">&#39;/usr/src/kernels/4.18.0-240.el8.x86_64&#39;</span>
</span></span><span style="display:flex;"><span>strip --strip-unneeded lime.ko
</span></span><span style="display:flex;"><span>mv lime.ko lime-4.18.0-240.el8.x86_64.ko
</span></span><span style="display:flex;"><span>$
</span></span><span style="display:flex;"><span>$
</span></span><span style="display:flex;"><span>$ ls -l lime-4.18.0-240.el8.x86_64.ko
</span></span><span style="display:flex;"><span>-rw-r--r--. <span style="color:#ae81ff">1</span> root root <span style="color:#ae81ff">25696</span> Apr <span style="color:#ae81ff">17</span> 14:45 lime-4.18.0-240.el8.x86_64.ko
</span></span><span style="display:flex;"><span>$
</span></span><span style="display:flex;"><span>$ file lime-4.18.0-240.el8.x86_64.ko
</span></span><span style="display:flex;"><span>lime-4.18.0-240.el8.x86_64.ko: ELF 64-bit LSB relocatable, x86-64, version <span style="color:#ae81ff">1</span> <span style="color:#f92672">(</span>SYSV<span style="color:#f92672">)</span>, BuildID<span style="color:#f92672">[</span>sha1<span style="color:#f92672">]=</span>1d0b5cf932389000d960a7e6b57c428b8e46c9cf, not stripped
</span></span><span style="display:flex;"><span>$
</span></span></code></pre></div><h3 id="加载lime-内核模块">加载LiME 内核模块</h3>
<p>现在是时候加载内核模块来获取系统内存了。insmod 命令会帮助加载内核模块；模块一旦被加载，会在你的系统上读取主内存（RAM）并且将内存的内容转储到命令行所提供的 path 目录下的文件中。另一个重要的参数是 format；保持 lime 的格式，如下所示。在插入内核模块之后，使用 lsmod 命令验证它是否真的被加载。</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>$ lsmod  | grep lime
</span></span><span style="display:flex;"><span>$
</span></span><span style="display:flex;"><span>$ insmod ./lime-4.18.0-240.el8.x86_64.ko <span style="color:#e6db74">&#34;path=../RHEL8.3_64bit.mem format=lime&#34;</span>
</span></span><span style="display:flex;"><span>$
</span></span><span style="display:flex;"><span>$ lsmod  | grep lime
</span></span><span style="display:flex;"><span>lime                   <span style="color:#ae81ff">16384</span>  <span style="color:#ae81ff">0</span>
</span></span><span style="display:flex;"><span>$
</span></span></code></pre></div><p>你应该看到给 path 命令的文件已经创建好了，而且文件大小与你系统的物理内存（RAM）大小相同（并不奇怪）。一旦你有了内存转储，你就可以使用 rmmod 命令删除该内核模块：</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>$
</span></span><span style="display:flex;"><span>$ ls -l ~/LiME/RHEL8.3_64bit.mem
</span></span><span style="display:flex;"><span>-r--r--r--. <span style="color:#ae81ff">1</span> root root <span style="color:#ae81ff">4294544480</span> Apr <span style="color:#ae81ff">17</span> 14:47 /root/LiME/RHEL8.3_64bit.mem
</span></span><span style="display:flex;"><span>$
</span></span><span style="display:flex;"><span>$ du -sh ~/LiME/RHEL8.3_64bit.mem
</span></span><span style="display:flex;"><span>4.0G    /root/LiME/RHEL8.3_64bit.mem
</span></span><span style="display:flex;"><span>$
</span></span><span style="display:flex;"><span>$ free -m
</span></span><span style="display:flex;"><span>              total        used        free      shared  buff/cache   available
</span></span><span style="display:flex;"><span>Mem:           <span style="color:#ae81ff">3736</span>         <span style="color:#ae81ff">220</span>         <span style="color:#ae81ff">366</span>           <span style="color:#ae81ff">8</span>        <span style="color:#ae81ff">3149</span>        <span style="color:#ae81ff">3259</span>
</span></span><span style="display:flex;"><span>Swap:          <span style="color:#ae81ff">4059</span>           <span style="color:#ae81ff">8</span>        <span style="color:#ae81ff">4051</span>
</span></span><span style="display:flex;"><span>$
</span></span><span style="display:flex;"><span>$ rmmod lime
</span></span><span style="display:flex;"><span>$
</span></span><span style="display:flex;"><span>$ lsmod  | grep lime
</span></span><span style="display:flex;"><span>$
</span></span></code></pre></div><h3 id="内存转储中是什么">内存转储中是什么？</h3>
<p>这个内存转储文件只是原始数据，就像使用 file 命令可以看到的一样。你不可能通过手动去理解它；是的，在这里边有一些 ASCII 字符，但是你无法用编辑器打开这个文件并把它读出来。hexdump 的输出显示，最初的几个字节是 EmiL；这是因为你的请求格式在上面的命令行中是 lime：</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>$ file ~/LiME/RHEL8.3_64bit.mem
</span></span><span style="display:flex;"><span>/root/LiME/RHEL8.3_64bit.mem: data
</span></span><span style="display:flex;"><span>$
</span></span><span style="display:flex;"><span>
</span></span><span style="display:flex;"><span>$ hexdump -C ~/LiME/RHEL8.3_64bit.mem | head
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">00000000</span>  <span style="color:#ae81ff">45</span> 4d <span style="color:#ae81ff">69</span> 4c <span style="color:#ae81ff">01</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span>  <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">10</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span>  |EMiL............|
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">00000010</span>  ff fb <span style="color:#ae81ff">09</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span>  <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span>  |................|
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">00000020</span>  b8 fe 4c cd <span style="color:#ae81ff">21</span> <span style="color:#ae81ff">44</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">32</span>  <span style="color:#ae81ff">20</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> 2a 2a 2a 2a 2a  |..L.!D.2 ..*****|
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">00000030</span>  2a 2a 2a 2a 2a 2a 2a 2a  2a 2a 2a 2a 2a 2a 2a 2a  |****************|
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">00000040</span>  2a 2a 2a 2a 2a 2a 2a 2a  2a 2a 2a 2a 2a <span style="color:#ae81ff">20</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">20</span>  |************* . |
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">00000050</span>  <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span>  <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span>  |................|
</span></span><span style="display:flex;"><span>*
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">00000080</span>  <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span>  <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">70</span> <span style="color:#ae81ff">78</span> <span style="color:#ae81ff">65</span> 6c  |............pxel|
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">00000090</span>  <span style="color:#ae81ff">69</span> 6e <span style="color:#ae81ff">75</span> <span style="color:#ae81ff">78</span> 2e <span style="color:#ae81ff">30</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span>  <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span>  |inux.0..........|
</span></span><span style="display:flex;"><span>000000a0  <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span>  <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span> <span style="color:#ae81ff">00</span>  |................|
</span></span><span style="display:flex;"><span>$
</span></span></code></pre></div><h2 id="部分-2获得-volatility-并使用它来分析你的内存转储">部分 2：获得 Volatility 并使用它来分析你的内存转储</h2>
<p>现在你有了要分析的示例内存转储，使用下面的命令获取 Volatility 软件。Volatility 已经用 Python 3 重写了，但是本教程使用的是用 Python 2 写的原始的 Volatility 包。如果你想用 Volatility 3 进行实验，可以从合适的 Git 仓库下载它，并在以下命令中使用 Python 3 而不是 Python 2：</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>$ git clone https://github.com/volatilityfoundation/volatility.git
</span></span><span style="display:flex;"><span>$
</span></span><span style="display:flex;"><span>$ cd volatility/
</span></span><span style="display:flex;"><span>$
</span></span><span style="display:flex;"><span>$ ls
</span></span><span style="display:flex;"><span>AUTHORS.txt    contrib      LEGAL.txt    Makefile     PKG-INFO     pyinstaller.spec  resources  tools       vol.py
</span></span><span style="display:flex;"><span>CHANGELOG.txt  CREDITS.txt  LICENSE.txt  MANIFEST.in  pyinstaller  README.txt        setup.py   volatility
</span></span><span style="display:flex;"><span>$
</span></span></code></pre></div><p>Volatility 使用两个 Python 库来实现某些功能，所以使用以下命令来安装它们。否则，在你运行 Volatility 工具时，你可能看到一些导入错误；你可以忽略它们，除非你正在运行的插件需要这些库；这种情况下，工具将会报错：</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>$ pip2 install pycrypto
</span></span><span style="display:flex;"><span>$ pip2 install distorm3
</span></span></code></pre></div><h3 id="列出-volatility-的-linux-配置文件">列出 Volatility 的 Linux 配置文件</h3>
<p>你将要运行的第一个 Volatility 命令列出了可用的 Linux 配置文件，运行 Volatility 命令的主要入口点是 vol.py 脚本。使用 Python 2 解释器调用它并提供 &ndash;info 选项。为了缩小输出，查找以 Linux 开头的字符串。正如你所看到的，并没有很多 Linux 配置文件被列出：</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>$ python2 vol.py --info  | grep ^Linux
</span></span><span style="display:flex;"><span>Volatility Foundation Volatility Framework 2.6.1
</span></span><span style="display:flex;"><span>LinuxAMD64PagedMemory          - Linux-specific AMD 64-bit address space.
</span></span><span style="display:flex;"><span>$
</span></span></code></pre></div><h3 id="构建你自己的-linux-配置文件">构建你自己的 Linux 配置文件</h3>
<p>Linux 发行版是多种多样的，并且是为不同架构而构建的。这就是为什么配置文件是必要的 —— Volatility 在提取信息前必须知道内存转储是从哪个系统和架构获得的。有一些 Volatility 命令可以找到这些信息；但是这个方法很费时。为了加快速度，可以使用以下命令构建一个自定义的 Linux 配置文件：</p>
<p>移动到 Volatility 仓库的 tools/linux目录下，运行 make 命令：</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>$ cd tools/linux/
</span></span><span style="display:flex;"><span>$
</span></span><span style="display:flex;"><span>$ pwd
</span></span><span style="display:flex;"><span>/root/volatility/tools/linux
</span></span><span style="display:flex;"><span>$
</span></span><span style="display:flex;"><span>$ ls
</span></span><span style="display:flex;"><span>kcore  Makefile  Makefile.enterprise  module.c
</span></span><span style="display:flex;"><span>$
</span></span><span style="display:flex;"><span>$ make
</span></span><span style="display:flex;"><span>make -C //lib/modules/4.18.0-240.el8.x86_64/build CONFIG_DEBUG_INFO<span style="color:#f92672">=</span>y M<span style="color:#f92672">=</span><span style="color:#e6db74">&#34;/root/volatility/tools/linux&#34;</span> modules
</span></span><span style="display:flex;"><span>make<span style="color:#f92672">[</span>1<span style="color:#f92672">]</span>: Entering directory <span style="color:#e6db74">&#39;/usr/src/kernels/4.18.0-240.el8.x86_64&#39;</span>
</span></span><span style="display:flex;"><span>&lt;&lt; 删节 &gt;&gt;
</span></span><span style="display:flex;"><span>make<span style="color:#f92672">[</span>1<span style="color:#f92672">]</span>: Leaving directory <span style="color:#e6db74">&#39;/usr/src/kernels/4.18.0-240.el8.x86_64&#39;</span>
</span></span><span style="display:flex;"><span>$
</span></span></code></pre></div><p>你应该看到一个新的 module.dwarf 文件。你也需要 /boot 目录下的 System.map 文件，因为它包含了所有与当前运行的内核相关的符号：</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>$ ls
</span></span><span style="display:flex;"><span>kcore  Makefile  Makefile.enterprise  module.c  module.dwarf
</span></span><span style="display:flex;"><span>$
</span></span><span style="display:flex;"><span>$ ls -l module.dwarf
</span></span><span style="display:flex;"><span>-rw-r--r--. <span style="color:#ae81ff">1</span> root root <span style="color:#ae81ff">3987904</span> Apr <span style="color:#ae81ff">17</span> 15:17 module.dwarf
</span></span><span style="display:flex;"><span>$
</span></span><span style="display:flex;"><span>$ ls -l /boot/System.map-4.18.0-240.el8.x86_64
</span></span><span style="display:flex;"><span>-rw-------. <span style="color:#ae81ff">1</span> root root <span style="color:#ae81ff">4032815</span> Sep <span style="color:#ae81ff">23</span>  <span style="color:#ae81ff">2020</span> /boot/System.map-4.18.0-240.el8.x86_64
</span></span><span style="display:flex;"><span>$
</span></span><span style="display:flex;"><span>$
</span></span></code></pre></div><p>要创建一个自定义配置文件，移动回到 Volatility 目录并且运行下面的命令。第一个参数提供了一个自定义 .zip 文件，文件名是你自己命名的。我经常使用操作系统和内核版本来命名。下一个参数是前边创建的 module.dwarf 文件，最后一个参数是 /boot 目录下的 System.map 文件：</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>$
</span></span><span style="display:flex;"><span>$ cd volatility/
</span></span><span style="display:flex;"><span>$
</span></span><span style="display:flex;"><span>$ zip volatility/plugins/overlays/linux/Redhat8.3_4.18.0-240.zip tools/linux/module.dwarf /boot/System.map-4.18.0-240.el8.x86_64
</span></span><span style="display:flex;"><span>  adding: tools/linux/module.dwarf <span style="color:#f92672">(</span>deflated 91%<span style="color:#f92672">)</span>
</span></span><span style="display:flex;"><span>  adding: boot/System.map-4.18.0-240.el8.x86_64 <span style="color:#f92672">(</span>deflated 79%<span style="color:#f92672">)</span>
</span></span><span style="display:flex;"><span>$
</span></span></code></pre></div><p>现在自定义配置文件就准备好了，所以在前边给出的位置检查一下 .zip 文件是否被创建好。如果你想知道 Volatility 是否检测到这个自定义配置文件，再一次运行 &ndash;info 命令。现在，你应该可以在下边的列出的内容中看到新的配置文件：</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>$
</span></span><span style="display:flex;"><span>$ ls -l volatility/plugins/overlays/linux/Redhat8.3_4.18.0-240.zip
</span></span><span style="display:flex;"><span>-rw-r--r--. <span style="color:#ae81ff">1</span> root root <span style="color:#ae81ff">1190360</span> Apr <span style="color:#ae81ff">17</span> 15:20 volatility/plugins/overlays/linux/Redhat8.3_4.18.0-240.zip
</span></span><span style="display:flex;"><span>$
</span></span><span style="display:flex;"><span>$
</span></span><span style="display:flex;"><span>$ python2 vol.py --info  | grep Redhat
</span></span><span style="display:flex;"><span>Volatility Foundation Volatility Framework 2.6.1
</span></span><span style="display:flex;"><span>LinuxRedhat8_3_4_18_0-240x64 - A Profile <span style="color:#66d9ef">for</span> Linux Redhat8.3_4.18.0-240 x64
</span></span><span style="display:flex;"><span>$
</span></span><span style="display:flex;"><span>$
</span></span></code></pre></div><h3 id="开始使用-volatility">开始使用 Volatility</h3>
<p>现在你已经准备好去做一些真正的内存取证了。记住，Volatility 是由自定义的插件组成的，你可以针对内存转储来获得信息。命令的通用格式是：</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>python2 vol.py -f &lt;memory-dump-file-taken-by-Lime&gt; &lt;plugin-name&gt; --profile<span style="color:#f92672">=</span>&lt;name-of-our-custom-profile&gt;
</span></span></code></pre></div><p>有了这些信息，运行 linux_banner 插件来看看你是否可从内存转储中识别正确的发行版信息：</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>$ python2 vol.py -f ~/LiME/RHEL8.3_64bit.mem linux_banner --profile<span style="color:#f92672">=</span>LinuxRedhat8_3_4_18_0-240x64
</span></span><span style="display:flex;"><span>Volatility Foundation Volatility Framework 2.6.1
</span></span><span style="display:flex;"><span>Linux version 4.18.0-240.el8.x86_64 <span style="color:#f92672">([</span>mockbuild@vm09.test.com<span style="color:#f92672">][</span>4<span style="color:#f92672">])</span> <span style="color:#f92672">(</span>gcc version 8.3.1 <span style="color:#ae81ff">20191121</span> <span style="color:#f92672">(</span>Red Hat 8.3.1-5<span style="color:#f92672">)</span> <span style="color:#f92672">(</span>GCC<span style="color:#f92672">))</span> <span style="color:#75715e">#1 SMP Wed Sep 23 05:13:10 EDT 2020</span>
</span></span><span style="display:flex;"><span>$
</span></span></code></pre></div><h3 id="找到-linux-插件">找到 Linux 插件</h3>
<p>到现在都很顺利，所以现在你可能对如何找到所有 Linux 插件的名字比较好奇。有一个简单的技巧：运行 &ndash;info 命令并抓取 linux_ 字符串。有各种各样的插件可用于不同的用途。这里列出一部分：</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>$ python2 vol.py --info  | grep linux_
</span></span><span style="display:flex;"><span>Volatility Foundation Volatility Framework 2.6.1
</span></span><span style="display:flex;"><span>linux_apihooks             - Checks <span style="color:#66d9ef">for</span> userland apihooks
</span></span><span style="display:flex;"><span>linux_arp                  - Print the ARP table
</span></span><span style="display:flex;"><span>linux_aslr_shift           - Automatically detect the Linux ASLR shift
</span></span><span style="display:flex;"><span>
</span></span><span style="display:flex;"><span>&lt;&lt; 删节 &gt;&gt;
</span></span><span style="display:flex;"><span>
</span></span><span style="display:flex;"><span>linux_banner               - Prints the Linux banner information
</span></span><span style="display:flex;"><span>linux_vma_cache            - Gather VMAs from the vm_area_struct cache
</span></span><span style="display:flex;"><span>linux_volshell             - Shell in the memory image
</span></span><span style="display:flex;"><span>linux_yarascan             - A shell in the Linux memory image
</span></span><span style="display:flex;"><span>$
</span></span></code></pre></div><p>使用 linux_psaux 插件检查内存转储时系统上正在运行哪些进程。注意列表中的最后一个命令：它是你在转储之前运行的 insmod 命令。</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>$ python2 vol.py -f ~/LiME/RHEL8.3_64bit.mem linux_psaux --profile<span style="color:#f92672">=</span>LinuxRedhat8_3_4_18_0-240x64
</span></span><span style="display:flex;"><span>Volatility Foundation Volatility Framework 2.6.1
</span></span><span style="display:flex;"><span>Pid    Uid    Gid    Arguments                                                      
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">1</span>      <span style="color:#ae81ff">0</span>      <span style="color:#ae81ff">0</span>      /usr/lib/systemd/systemd --switched-root --system --deserialize <span style="color:#ae81ff">18</span>
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">2</span>      <span style="color:#ae81ff">0</span>      <span style="color:#ae81ff">0</span>      <span style="color:#f92672">[</span>kthreadd<span style="color:#f92672">]</span>                                                      
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">3</span>      <span style="color:#ae81ff">0</span>      <span style="color:#ae81ff">0</span>      <span style="color:#f92672">[</span>rcu_gp<span style="color:#f92672">]</span>                                                        
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">4</span>      <span style="color:#ae81ff">0</span>      <span style="color:#ae81ff">0</span>      <span style="color:#f92672">[</span>rcu_par_gp<span style="color:#f92672">]</span>                                                    
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">861</span>    <span style="color:#ae81ff">0</span>      <span style="color:#ae81ff">0</span>      /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P          
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">869</span>    <span style="color:#ae81ff">0</span>      <span style="color:#ae81ff">0</span>      /usr/bin/rhsmcertd                                              
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">875</span>    <span style="color:#ae81ff">0</span>      <span style="color:#ae81ff">0</span>      /usr/libexec/sssd/sssd_be --domain implicit_files --uid <span style="color:#ae81ff">0</span> --gid <span style="color:#ae81ff">0</span> --logger<span style="color:#f92672">=</span>files
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">878</span>    <span style="color:#ae81ff">0</span>      <span style="color:#ae81ff">0</span>      /usr/libexec/sssd/sssd_nss --uid <span style="color:#ae81ff">0</span> --gid <span style="color:#ae81ff">0</span> --logger<span style="color:#f92672">=</span>files      
</span></span><span style="display:flex;"><span>
</span></span><span style="display:flex;"><span>&lt;&lt; 删节 &gt;&gt;
</span></span><span style="display:flex;"><span>
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">11064</span>  <span style="color:#ae81ff">89</span>     <span style="color:#ae81ff">89</span>     qmgr -l -t unix -u                                              
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">227148</span> <span style="color:#ae81ff">0</span>      <span style="color:#ae81ff">0</span>      <span style="color:#f92672">[</span>kworker/0:0<span style="color:#f92672">]</span>                                                  
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">227298</span> <span style="color:#ae81ff">0</span>      <span style="color:#ae81ff">0</span>      -bash                                                          
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">227374</span> <span style="color:#ae81ff">0</span>      <span style="color:#ae81ff">0</span>      <span style="color:#f92672">[</span>kworker/u2:1<span style="color:#f92672">]</span>                                                  
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">227375</span> <span style="color:#ae81ff">0</span>      <span style="color:#ae81ff">0</span>      <span style="color:#f92672">[</span>kworker/0:2<span style="color:#f92672">]</span>                                                  
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">227884</span> <span style="color:#ae81ff">0</span>      <span style="color:#ae81ff">0</span>      <span style="color:#f92672">[</span>kworker/0:3<span style="color:#f92672">]</span>                                                  
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">228573</span> <span style="color:#ae81ff">0</span>      <span style="color:#ae81ff">0</span>      insmod ./lime-4.18.0-240.el8.x86_64.ko path<span style="color:#f92672">=</span>../RHEL8.3_64bit.mem format<span style="color:#f92672">=</span>lime
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">228576</span> <span style="color:#ae81ff">0</span>      <span style="color:#ae81ff">0</span>                                                                      
</span></span><span style="display:flex;"><span>$
</span></span></code></pre></div><p>想要知道系统的网络状态吗？运行 linux_netstat 插件来找到在内存转储期间网络连接的状态：</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>$ python2 vol.py -f ~/LiME/RHEL8.3_64bit.mem linux_netstat --profile<span style="color:#f92672">=</span>LinuxRedhat8_3_4_18_0-240x64
</span></span><span style="display:flex;"><span>Volatility Foundation Volatility Framework 2.6.1
</span></span><span style="display:flex;"><span>UNIX <span style="color:#ae81ff">18113</span>              systemd/1     /run/systemd/private
</span></span><span style="display:flex;"><span>UNIX <span style="color:#ae81ff">11411</span>              systemd/1     /run/systemd/notify
</span></span><span style="display:flex;"><span>UNIX <span style="color:#ae81ff">11413</span>              systemd/1     /run/systemd/cgroups-agent
</span></span><span style="display:flex;"><span>UNIX <span style="color:#ae81ff">11415</span>              systemd/1    
</span></span><span style="display:flex;"><span>UNIX <span style="color:#ae81ff">11416</span>              systemd/1    
</span></span><span style="display:flex;"><span>
</span></span><span style="display:flex;"><span>&lt;&lt; 删节 &gt;&gt;
</span></span><span style="display:flex;"><span>$
</span></span></code></pre></div><p>接下来，使用 linux_mount 插件来看在内存转储期间哪些文件系统被挂载：</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>$ python2 vol.py -f ~/LiME/RHEL8.3_64bit.mem linux_mount --profile<span style="color:#f92672">=</span>LinuxRedhat8_3_4_18_0-240x64
</span></span><span style="display:flex;"><span>Volatility Foundation Volatility Framework 2.6.1
</span></span><span style="display:flex;"><span>tmpfs                     /sys/fs/cgroup                      tmpfs        ro,nosuid,nodev,noexec                  
</span></span><span style="display:flex;"><span>cgroup                    /sys/fs/cgroup/pids                 cgroup       rw,relatime,nosuid,nodev,noexec        
</span></span><span style="display:flex;"><span>systemd-1                 /proc/sys/fs/binfmt_misc            autofs       rw,relatime                            
</span></span><span style="display:flex;"><span>sunrpc                    /var/lib/nfs/rpc_pipefs             rpc_pipefs   rw,relatime                            
</span></span><span style="display:flex;"><span>/dev/mapper/rhel_kvm--03--guest11-root /                                   xfs          rw,relatime                
</span></span><span style="display:flex;"><span>tmpfs                     /dev/shm                            tmpfs        rw,nosuid,nodev                        
</span></span><span style="display:flex;"><span>selinuxfs                 /sys/fs/selinux                     selinuxfs    rw,relatime
</span></span><span style="display:flex;"><span>                                                      
</span></span><span style="display:flex;"><span>&lt;&lt; 删节 &gt;&gt;
</span></span><span style="display:flex;"><span>
</span></span><span style="display:flex;"><span>cgroup                    /sys/fs/cgroup/net_cls,net_prio     cgroup       rw,relatime,nosuid,nodev,noexec        
</span></span><span style="display:flex;"><span>cgroup                    /sys/fs/cgroup/cpu,cpuacct          cgroup       rw,relatime,nosuid,nodev,noexec        
</span></span><span style="display:flex;"><span>bpf                       /sys/fs/bpf                         bpf          rw,relatime,nosuid,nodev,noexec        
</span></span><span style="display:flex;"><span>cgroup                    /sys/fs/cgroup/memory               cgroup       ro,relatime,nosuid,nodev,noexec        
</span></span><span style="display:flex;"><span>cgroup                    /sys/fs/cgroup/cpuset               cgroup       rw,relatime,nosuid,nodev,noexec        
</span></span><span style="display:flex;"><span>mqueue                    /dev/mqueue                         mqueue       rw,relatime                            
</span></span><span style="display:flex;"><span>$
</span></span></code></pre></div><p>好奇哪些内核模块被加载了吗？Volatility 也为这个提供了一个插件 linux_lsmod：</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>$ python2 vol.py -f ~/LiME/RHEL8.3_64bit.mem linux_lsmod --profile<span style="color:#f92672">=</span>LinuxRedhat8_3_4_18_0-240x64
</span></span><span style="display:flex;"><span>Volatility Foundation Volatility Framework 2.6.1
</span></span><span style="display:flex;"><span>ffffffffc0535040 lime <span style="color:#ae81ff">20480</span>
</span></span><span style="display:flex;"><span>ffffffffc0530540 binfmt_misc <span style="color:#ae81ff">20480</span>
</span></span><span style="display:flex;"><span>ffffffffc05e8040 sunrpc <span style="color:#ae81ff">479232</span>
</span></span><span style="display:flex;"><span>&lt;&lt; 删节 &gt;&gt;
</span></span><span style="display:flex;"><span>ffffffffc04f9540 nfit <span style="color:#ae81ff">65536</span>
</span></span><span style="display:flex;"><span>ffffffffc0266280 dm_mirror <span style="color:#ae81ff">28672</span>
</span></span><span style="display:flex;"><span>ffffffffc025e040 dm_region_hash <span style="color:#ae81ff">20480</span>
</span></span><span style="display:flex;"><span>ffffffffc0258180 dm_log <span style="color:#ae81ff">20480</span>
</span></span><span style="display:flex;"><span>ffffffffc024bbc0 dm_mod <span style="color:#ae81ff">151552</span>
</span></span><span style="display:flex;"><span>$
</span></span></code></pre></div><p>想知道哪些文件被哪些进程打开了吗？使用 linux_bash 插件可以列出这些信息：</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>$ python2 vol.py -f ~/LiME/RHEL8.3_64bit.mem linux_bash --profile<span style="color:#f92672">=</span>LinuxRedhat8_3_4_18_0-240x64 -v
</span></span><span style="display:flex;"><span>Volatility Foundation Volatility Framework 2.6.1
</span></span><span style="display:flex;"><span>Pid      Name                 Command Time                   Command
</span></span><span style="display:flex;"><span>-------- -------------------- ------------------------------ -------
</span></span><span style="display:flex;"><span>  <span style="color:#ae81ff">227221</span> bash                 2021-04-17 18:38:24 UTC+0000   lsmod
</span></span><span style="display:flex;"><span>  <span style="color:#ae81ff">227221</span> bash                 2021-04-17 18:38:24 UTC+0000   rm -f .log
</span></span><span style="display:flex;"><span>  <span style="color:#ae81ff">227221</span> bash                 2021-04-17 18:38:24 UTC+0000   ls -l /etc/zzz
</span></span><span style="display:flex;"><span>  <span style="color:#ae81ff">227221</span> bash                 2021-04-17 18:38:24 UTC+0000   cat ~/.vimrc
</span></span><span style="display:flex;"><span>  <span style="color:#ae81ff">227221</span> bash                 2021-04-17 18:38:24 UTC+0000   ls
</span></span><span style="display:flex;"><span>  <span style="color:#ae81ff">227221</span> bash                 2021-04-17 18:38:24 UTC+0000   cat /proc/817/cwd
</span></span><span style="display:flex;"><span>  <span style="color:#ae81ff">227221</span> bash                 2021-04-17 18:38:24 UTC+0000   ls -l /proc/817/cwd
</span></span><span style="display:flex;"><span>  <span style="color:#ae81ff">227221</span> bash                 2021-04-17 18:38:24 UTC+0000   ls /proc/817/
</span></span><span style="display:flex;"><span>&lt;&lt; 删节 &gt;&gt;
</span></span><span style="display:flex;"><span>  <span style="color:#ae81ff">227298</span> bash                 2021-04-17 18:40:30 UTC+0000   gcc prt.c
</span></span><span style="display:flex;"><span>  <span style="color:#ae81ff">227298</span> bash                 2021-04-17 18:40:30 UTC+0000   ls
</span></span><span style="display:flex;"><span>  <span style="color:#ae81ff">227298</span> bash                 2021-04-17 18:40:30 UTC+0000   ./a.out
</span></span><span style="display:flex;"><span>  <span style="color:#ae81ff">227298</span> bash                 2021-04-17 18:40:30 UTC+0000   vim prt.c
</span></span><span style="display:flex;"><span>  <span style="color:#ae81ff">227298</span> bash                 2021-04-17 18:40:30 UTC+0000   gcc prt.c
</span></span><span style="display:flex;"><span>  <span style="color:#ae81ff">227298</span> bash                 2021-04-17 18:40:30 UTC+0000   ./a.out
</span></span><span style="display:flex;"><span>  <span style="color:#ae81ff">227298</span> bash                 2021-04-17 18:40:30 UTC+0000   ls
</span></span><span style="display:flex;"><span>$
</span></span></code></pre></div><p>想知道哪些文件被哪些进程打开了吗？使用 linux_lsof 插件可以列出这些信息：</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>$ python2 vol.py -f ~/LiME/RHEL8.3_64bit.mem linux_lsof --profile<span style="color:#f92672">=</span>LinuxRedhat8_3_4_18_0-240x64
</span></span><span style="display:flex;"><span>Volatility Foundation Volatility Framework 2.6.1
</span></span><span style="display:flex;"><span>Offset             Name                           Pid      FD       Path
</span></span><span style="display:flex;"><span>------------------ ------------------------------ -------- -------- ----
</span></span><span style="display:flex;"><span>0xffff9c83fb1e9f40 rsyslogd                          <span style="color:#ae81ff">71194</span>        <span style="color:#ae81ff">0</span> /dev/null
</span></span><span style="display:flex;"><span>0xffff9c83fb1e9f40 rsyslogd                          <span style="color:#ae81ff">71194</span>        <span style="color:#ae81ff">1</span> /dev/null
</span></span><span style="display:flex;"><span>0xffff9c83fb1e9f40 rsyslogd                          <span style="color:#ae81ff">71194</span>        <span style="color:#ae81ff">2</span> /dev/null
</span></span><span style="display:flex;"><span>0xffff9c83fb1e9f40 rsyslogd                          <span style="color:#ae81ff">71194</span>        <span style="color:#ae81ff">3</span> /dev/urandom
</span></span><span style="display:flex;"><span>0xffff9c83fb1e9f40 rsyslogd                          <span style="color:#ae81ff">71194</span>        <span style="color:#ae81ff">4</span> socket:<span style="color:#f92672">[</span>83565<span style="color:#f92672">]</span>
</span></span><span style="display:flex;"><span>0xffff9c83fb1e9f40 rsyslogd                          <span style="color:#ae81ff">71194</span>        <span style="color:#ae81ff">5</span> /var/log/messages
</span></span><span style="display:flex;"><span>0xffff9c83fb1e9f40 rsyslogd                          <span style="color:#ae81ff">71194</span>        <span style="color:#ae81ff">6</span> anon_inode:<span style="color:#f92672">[</span>9063<span style="color:#f92672">]</span>
</span></span><span style="display:flex;"><span>0xffff9c83fb1e9f40 rsyslogd                          <span style="color:#ae81ff">71194</span>        <span style="color:#ae81ff">7</span> /var/log/secure
</span></span><span style="display:flex;"><span>
</span></span><span style="display:flex;"><span>&lt;&lt; 删节 &gt;&gt;
</span></span><span style="display:flex;"><span>
</span></span><span style="display:flex;"><span>0xffff9c8365761f40 insmod                           <span style="color:#ae81ff">228573</span>        <span style="color:#ae81ff">0</span> /dev/pts/0
</span></span><span style="display:flex;"><span>0xffff9c8365761f40 insmod                           <span style="color:#ae81ff">228573</span>        <span style="color:#ae81ff">1</span> /dev/pts/0
</span></span><span style="display:flex;"><span>0xffff9c8365761f40 insmod                           <span style="color:#ae81ff">228573</span>        <span style="color:#ae81ff">2</span> /dev/pts/0
</span></span><span style="display:flex;"><span>0xffff9c8365761f40 insmod                           <span style="color:#ae81ff">228573</span>        <span style="color:#ae81ff">3</span> /root/LiME/src/lime-4.18.0-240.el8.x86_64.ko
</span></span><span style="display:flex;"><span>$
</span></span></code></pre></div><h3 id="访问-linux-插件脚本位置">访问 Linux 插件脚本位置</h3>
<p>通过读取内存转储和处理这些信息，你可以获得更多的信息。如果你会 Python，并且好奇这些信息是如何被处理的，可以到存储所有插件的目录，选择一个你感兴趣的，并看看 Volatility 是如何获得这些信息的：</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>$ ls volatility/plugins/linux/
</span></span><span style="display:flex;"><span>apihooks.py              common.py            kernel_opened_files.py   malfind.py          psaux.py
</span></span><span style="display:flex;"><span>apihooks.pyc             common.pyc           kernel_opened_files.pyc  malfind.pyc         psaux.pyc
</span></span><span style="display:flex;"><span>arp.py                   cpuinfo.py           keyboard_notifiers.py    mount_cache.py      psenv.py
</span></span><span style="display:flex;"><span>arp.pyc                  cpuinfo.pyc          keyboard_notifiers.pyc   mount_cache.pyc     psenv.pyc
</span></span><span style="display:flex;"><span>aslr_shift.py            dentry_cache.py      ld_env.py                mount.py            pslist_cache.py
</span></span><span style="display:flex;"><span>aslr_shift.pyc           dentry_cache.pyc     ld_env.pyc               mount.pyc           pslist_cache.pyc
</span></span><span style="display:flex;"><span>&lt;&lt; 删节 &gt;&gt;
</span></span><span style="display:flex;"><span>check_syscall_arm.py     __init__.py          lsmod.py                 proc_maps.py        tty_check.py
</span></span><span style="display:flex;"><span>check_syscall_arm.pyc    __init__.pyc         lsmod.pyc                proc_maps.pyc       tty_check.pyc
</span></span><span style="display:flex;"><span>check_syscall.py         iomem.py             lsof.py                  proc_maps_rb.py     vma_cache.py
</span></span><span style="display:flex;"><span>check_syscall.pyc        iomem.pyc            lsof.pyc                 proc_maps_rb.pyc    vma_cache.pyc
</span></span><span style="display:flex;"><span>$
</span></span><span style="display:flex;"><span>$
</span></span></code></pre></div><p>我喜欢 Volatility 的理由是他提供了许多安全插件。这些信息很难手动获取：</p>
<pre><code>linux_hidden_modules       - Carves memory to find hidden kernel modules
linux_malfind              - Looks for suspicious process mappings
linux_truecrypt_passphrase - Recovers cached Truecrypt passphrases
</code></pre>
<p>Volatility 也允许你在内存转储中打开一个 shell，所以你可以运行 shell 命令来代替上面所有命令，并获得相同的信息：</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>$ python2 vol.py -f ~/LiME/RHEL8.3_64bit.mem linux_volshell --profile<span style="color:#f92672">=</span>LinuxRedhat8_3_4_18_0-240x64 -v
</span></span><span style="display:flex;"><span>Volatility Foundation Volatility Framework 2.6.1
</span></span><span style="display:flex;"><span>Current context: process systemd, pid<span style="color:#f92672">=</span><span style="color:#ae81ff">1</span> DTB<span style="color:#f92672">=</span>0x1042dc000
</span></span><span style="display:flex;"><span>Welcome to volshell! Current memory image is:
</span></span><span style="display:flex;"><span>file:///root/LiME/RHEL8.3_64bit.mem
</span></span><span style="display:flex;"><span>To get help, type <span style="color:#e6db74">&#39;hh()&#39;</span>
</span></span><span style="display:flex;"><span>&gt;&gt;&gt;
</span></span><span style="display:flex;"><span>&gt;&gt;&gt; sc<span style="color:#f92672">()</span>
</span></span><span style="display:flex;"><span>Current context: process systemd, pid<span style="color:#f92672">=</span><span style="color:#ae81ff">1</span> DTB<span style="color:#f92672">=</span>0x1042dc000
</span></span><span style="display:flex;"><span>&gt;&gt;&gt;
</span></span></code></pre></div><h2 id="接下来的步骤">接下来的步骤</h2>
<p>内存转储是了解 Linux 内部情况的好方法。试一试 Volatility 的所有插件，并详细研究它们的输出。然后思考这些信息如何能够帮助你识别入侵或安全问题。深入了解这些插件的工作原理，甚至尝试改进它们。如果你没有找到你想做的事情的插件，那就写一个并提交给 Volatility，这样其他人也可以使用它。</p>
<h3 id="参考">参考</h3>
<p>使用开源工具进行 Linux 内存取证 <a href="https://linux.cn/article-13425-1.html">[1]</a></p>
<p>Perform Linux memory forensics with this open source tool <a href="https://opensource.com/article/21/4/linux-memory-forensics">[2]</a></p>



          </div>
        </div>
      </div>
    </div>
  </div>

  <div class="my-4 footer">
  <div class="container">
    <div class="row justify-content-center">
      <div class="col-sm-12 col-md-6 col-lg-5">
        <div class="mx-0 mx-md-4 mb-2 text-center text-md-start">
          
            <div>
              <a class="mx-1 mr-md-2 ml-md-0 " href="https://beian.miit.gov.cn/">
                
                豫ICP备13005404号
              </a>
            </div>
          

          
            
              <a href="https://www.lyhuilin.com">白菜林</a>
            
          
        </div>
      </div>
      <div class="col-sm-12 col-md-6 col-lg-5">
        <div class="mx-0 mx-md-4 text-center text-md-end">
          

          

          
  <a href="https://github.com/clin003"
     target="_blank"
     class="mx-1 ml-md-2 mr-md-0 icon"
     aria-label="GitHub">

    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" fill-rule="evenodd" clip-rule="evenodd" stroke-linejoin="round" stroke-miterlimit="1.414">
      <path d="M8 0C3.58 0 0 3.582 0 8c0 3.535 2.292 6.533 5.47 7.59.4.075.547-.172.547-.385 0-.19-.007-.693-.01-1.36-2.226.483-2.695-1.073-2.695-1.073-.364-.924-.89-1.17-.89-1.17-.725-.496.056-.486.056-.486.803.056 1.225.824 1.225.824.714 1.223 1.873.87 2.33.665.072-.517.278-.87.507-1.07-1.777-.2-3.644-.888-3.644-3.953 0-.873.31-1.587.823-2.147-.09-.202-.36-1.015.07-2.117 0 0 .67-.215 2.2.82.64-.178 1.32-.266 2-.27.68.004 1.36.092 2 .27 1.52-1.035 2.19-.82 2.19-.82.43 1.102.16 1.915.08 2.117.51.56.82 1.274.82 2.147 0 3.073-1.87 3.75-3.65 3.947.28.24.54.73.54 1.48 0 1.07-.01 1.93-.01 2.19 0 .21.14.46.55.38C13.71 14.53 16 11.53 16 8c0-4.418-3.582-8-8-8"/>
    </svg>
  </a>


          

          

          

          

          

          
  <a href="mailto:hi@lyhuilin.com"
     class="mx-1 ml-md-2 mr-md-0 icon"
     aria-label="Email">

    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 14 16">
      <path d="M0 4v8c0 .55.45 1 1 1h12c.55 0 1-.45 1-1V4c0-.55-.45-1-1-1H1c-.55 0-1 .45-1 1zm13 0L7 9 1 4h12zM1 5.5l4 3-4 3v-6zM2 12l3.5-3L7 10.5 8.5 9l3.5 3H2zm11-.5l-4-3 4-3v6z"/>
    </svg>
  </a>


          <a href=''
   class="mx-1 ml-md-2 mr-md-0 icon"
   aria-label="RSS">

  <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" fill-rule="evenodd" clip-rule="evenodd" stroke-linejoin="round" stroke-miterlimit="1.414">
    <path d="M12.8 16C12.8 8.978 7.022 3.2 0 3.2V0c8.777 0 16 7.223 16 16h-3.2zM2.194 11.61c1.21 0 2.195.985 2.195 2.196 0 1.21-.99 2.194-2.2 2.194C.98 16 0 15.017 0 13.806c0-1.21.983-2.195 2.194-2.195zM10.606 16h-3.11c0-4.113-3.383-7.497-7.496-7.497v-3.11c5.818 0 10.606 4.79 10.606 10.607z"/>
  </svg>
</a>


          
        </div>
      </div>
    </div>
  </div>
</div>



    <script src="//cdn.jsdelivr.net/npm/bootstrap@5.0.1/dist/js/bootstrap.bundle.min.js"
            integrity="sha384-gtEjrD/SeCtmISkJkNUaaKMoLD0//ElJ19smozuHV6z3Iehds+3Ulb9Bn9Plx0x4"
            crossorigin="anonymous"></script>

    

    

    

    
    
  </body>

</html>
